FFT news digest — 25 August 2023
FFT news digest — 25 August 2023
Pesky kids
When next a technology giant tells us it’s the victim of a sophisticated attack, we might want to consider the case of the teenagers behind a hacking spree against some of the world’s largest companies. This week, a jury in London concluded that the 17 and 18-year old males were part of the Lapsus$ group which broke into and tried to extort firms including Microsoft, Samsung, Vodafone, Revolut, and Okta. In an added wrinkle, the 18-year old is autistic and assessed as not fit to stand trial so the jury was told to decide whether he had carried out the acts rather than deliver a verdict of guilty or not guilty. The multi-episode hacking spree ended when City of London police caught the 18-year old red-handed in mid-hack. At the time, he was on bail and staying in a hotel room where police had placed him for his own safety because rival hackers had published his details online. In a “flagrant disregard for his bail conditions”, police found an Amazon Fire Stick in his hotel TV allowing him to connect to cloud computing services with a newly purchased smartphone, keyboard and mouse. The Lapsus$ gang’s activities prompted a review by US cyber agencies which concluded that organisations need to improve their defences against the increasing threat from teenage hackers. The report pointed to the perpetrators’ “special talent for social engineering” which they used to lure “employees to essentially open the gates to the corporate network”. Among its recommendations; - Multi-factor authentication (MFA) implementations are frequently ineffective, particularly when they involve SMS and voice calls. - SIM swapping makes it easy to gain initial access to organisations. - There’s too little focus on the risk from third-party service providers and suppliers. - Relatively minor consequences for juveniles mean laws have little deterrent effect.
Threats
Trends : Reporting from security companies suggests there’s been a surge in ransomware attacks in recent weeks. A round-up by SecurityWeek reveals an apparent increase both in terms of volume and sophistication. NCC Group says it saw over 500 attacks last month, 153% more than July 2022 with the industrials sector continuing to be the most targeted. The recent surge is largely ascribed to the Cl0p group, which targeted hundreds of organizations through a previously unknown (‘zero-day’) vulnerability in the MOVEit file transfer platform. According to Emsisoft, this has so far affected 730 organizations and over 47 million people. There’s also been a spike in traffic to phishing pages hosted by Cloudflare’s free hosting service - and many are evading security solutions. The majority of the campaigns are focussed on Microsoft login credentials, although some also target Adobe, Dropbox, and other cloud apps. They avoid detection both by protecting the pages with a CAPTCHA challenge and by only loading content if a visitor arrives from another malicious site. Netskope has details as well as examples of the malicious pages. Barracuda : The FBI is warning that Email Security Gateway (ESG) appliances remain vulnerable to attack despite a recent update, It says Chinese attackers continue to exploit the issue to access email servers around the world. AI : A cautionary tale from a “security pro” about how he almost fell victim to an AI-assisted phishing scam. The lure was a horribly authentic-looking invoice from payment processor, Stripe. ZDNET Duolingo : The data of 2.6 million users has been offered for sale on a Dark Web site. Details included users’ email addresses together with information about their accounts, making for perfect phishing fodder. Bleeping Computer Smart : Like many security folk, we’re not keen on smart devices. They’re frequently riddled with vulnerabilities and the latest example comes from tech giant, TP-Link. Italian researchers have found four serious issues with its smart Wi-Fi light bulb (L530E). The most serious could be used to reveal the user’s TP-Link credentials - and their WiFi details.
AI
The US cybersecurity agency has called for technology companies to build security into their AI systems from the outset. The fact that the agency is having to issue such an appeal is hardly reassuring since “Security by Design” is supposed to be a basic tenet of software development. As the agency says, “Discussions of artificial intelligence often swirl with mysticism regarding how an AI system functions. The reality is far more simple: AI is a type of software system.” Sentiment : US Customs and Border Protection is using AI-powered technology to detect “sentiment and emotion” in online posts, according to documents obtained by 404 Media. The agency said it was analysing technology to analyze open source information related to inbound and outbound travelers who the agency believes may threaten public safety, national security, or lawful trade and travel. Jobs : The UN says generative AI tools like ChatGPT won’t affect most people’s jobs - except for clerical workers. Most jobs “are more likely to be complemented rather than substituted by AI,” according to the International Labour Organisation. The glaring exception are clerical tasks - with a disproportionate impact on female workers. Cars : The latest AI camera technology has been used to identify nearly 300 British drivers breaking the law by using their cellphones or failing to wear a seatbelt. The latest devices are designed to create an image of the interior of the vehicle. Reclaim the Net
In brief
Friends and family : In awareness sessions for individuals at high-risk, we stress the importance of considering the security of family members and friends. This now appears to be a growing concern for commercial organisations as well. Forbes reported earlier this year about the case of a teenager targeted by attackers who threatened to tell his parents he was gay unless he installed files on his home WiFi network. Personal data : A report from a new technology website sets out the horrific extent to which people’s personal information is exposed. As Media 404 explains, “most Americans have very little choice but to provide their personal information to credit bureaus. Hackers have found a way into that data supply chain, and are advertising access in group chats used by violent criminals who rob, assault, and shoot targets.” (Media 404 was set up by some of the journalists who previously worked for Vice Media’s Motherboard website; well worth a look.) Scraping : Meanwhile, data protection regulators from 12 countries have published a joint statement warning companies not to harvest personal information from social media sites. The countries are Argentina, Australia, Canada, China, Colombia, Mexico, Morocco, New Zealand, Norway, Switzerland, the UK, and the US. SanDisk : Two lawsuits have accused Western Digital of producing hard disks that are “worthless”. They follow a flood of complaints by users - and reporting by journalists - about their travails with SanDisk Extreme SSDs. In the worst cases, the disks wiped the data on them and could no longer be accessed. Ars Technica Bagged : Apple AirTags and similar tracking tiles are becoming a real headache for airlines and a boon for travellers whose bags go astray. As AppleInsider reports , an AirTag helped a Canadian man get his luggage back after United Airlines lost it and lied repeatedly about where it was. Up for auction : Venerable auctioneers, Christies, accidentally revealed the exact location of prospective sellers’ artwork for anyone to view online. German researchers found they had failed to remove the GPS coordinates from photos uploaded to their website. The Washington Post Space : US intelligence agencies say foreign spies are targeting the country’s space industry as well as its satellite infrastructure. Some of the methods cited are as mundane as they are effective. They include approaching industry experts at conferences or contacting them through online forums. Travelling pants : A US research agency is working on a project to create smart clothing equipped with audio, video and geolocation sensors. The technology would be woven into into normal clothing like shirts and trousers, and even socks and underwear. IARPA Nextgov